WO2016107410A1

WO2016107410A1 - Communication control device, authentication device, central control device, and communication system

Info

Publication number: WO2016107410A1
Application number: PCT/CN2015/097559
Authority: WO
Inventors: 杨宪国; 孙卫平
Original assignee: 悠游宝（天津）网络科技有限公司
Priority date: 2014-12-30
Filing date: 2015-12-16
Publication date: 2016-07-07
Also published as: HK1207233A1; RU2636679C2; CN104519480B; AU2015261578A1; JP2016127598A; MY175039A; TW201625029A; US20160192287A1; CA2913456C; TWI563858B; SG10201509653XA; RU2015153111A; AU2015261578B2; US9723549B2; CA2913456A1; KR101727414B1; CN104519480A; KR20160081798A; EP3041189A1

Abstract

The present application provides a communication control device, an authentication device, a central control device, and a communication system. The communication control device controls the authentication device that is disposed on a mobile terminal and is used for authenticating the identity of a mobile user, so as to allow the mobile terminal to select different operator networks for communication. The communication control device comprises: a first acquiring unit, for acquiring identification information of the authentication device; a first authentication unit, for sending the identification information to a server to allow the server to perform identity authentication; a second acquiring unit, for acquiring a session key from the server and attribute setting information encrypted by means of the session key; and a first sending unit, for sending the session key and the encrypted attribute setting information to the authentication device to allow the authentication device to acquire the attribute setting information by means of decryption and set an operator attribute of the authentication device according to the attribute setting information. The present application can help a user autonomously rewrite the authentication device so as to select and use a network service of the operator.

Description

Communication control device, authentication device, central control device, and communication system

Technical field

The present application relates to the field of communications technologies, and in particular, to a communication control device, an authentication device, and a central control device.

Background technique

A Subscriber Identity Module (SIM) card is a device for realizing mobile user identity authentication. Each user's SIM card is written by the operator with different number data, so that after logging in to the mobile network, Can be uniquely identified and accessed by the network.

A common method for writing number data for a SIM card is a remote write card. The remote write card is used by the operator during the operation. When the user opens an account, the data is sent to the point of sale (POS) through the remote server. An operation in which a card writer instantly writes number data to a SIM card.

In the prior art, there is also a SIM film card card technology, which refers to adding a layer of bridge film card with bidirectional input and output (IO) processing capability between the SIM card of the mobile phone and the SIM card slot of the mobile phone. Therefore, on the basis of ensuring the normal interaction between the mobile phone and the SIM card, a customized expansion function is realized by having a programmable film card. Common extensions include SIM card user application development tools (SIM TOOL KIT, STK) extensions, over-the-air (OTA) update applications, and more.

It should be noted that the above description of the technical background is only for the purpose of facilitating a clear and complete description of the technical solutions of the present application, and is convenient for understanding by those skilled in the art. The above technical solutions are not considered to be well known to those skilled in the art simply because these aspects are set forth in the background section of this application.

Application content

The inventor of the present application has found that in the prior art, for a remote write card, an additional write card hardware device is required for support, and the user needs to go to the business hall to be handled by the agent. Therefore, the existing method of writing number data has the following problems in practical applications:

1) Due to the existence of monopoly factors, foreign operators cannot simply write and issue cards for users directly through the above-mentioned technologies;

2) Due to the limitation of hardware and special SIM card, the card can only be issued indirectly to the user. The user cannot complete the card writing and card clearing operations on the SIM card, so it is impossible to customize and replace the operator and service.

3) The above-mentioned technologies and corresponding systems are designed from the perspective of unilateral operation of operators, rather than third-party public platforms, so they cannot be quickly opened on a SIM card by multi-number writing and switching of different carrier numbers. The user provides multi-operator service sharing, or rewrites the number information to implement the exit of the old operator and the joining of the new operator.

Therefore, the above three aspects increase the cost and inconvenience of network operators and mobile network users.

In addition, for the SIM film card technology, the prior art mainly attaches the SIM film card to the surface of the SIM card in the form of a film, and combines to realize the STK expansion of the ordinary SIM card, so the SIM film card mainly serves as the auxiliary SIM card. The function is to make the SIM film card card realize the same user identification and network access function as the SIM card and expand the application.

The embodiment of the present application provides a communication control device, an authentication device, a central control device, and a communication system. The central control device authenticates the authentication device and issues attribute setting information, and controls the authentication device through the communication control device. So that the authentication device sets its own attributes according to the attribute setting information, so that the mobile terminal can select different carrier networks for communication.

According to an aspect of the embodiments of the present application, a communication control apparatus is provided, which controls an authentication apparatus for performing mobile user identity authentication on a mobile terminal, so that the mobile terminal can select a different carrier network. Communication, the communication control device has:

a first obtaining unit, configured to acquire identification information of the authentication device;

a first authentication unit, configured to send the identification information to a server, so that the server performs identity authentication on the authentication device;

a second obtaining unit, configured to acquire a session key from the server, and attribute setting information encrypted by the session key;

a first sending unit, configured to send the session key and the encrypted attribute setting information to the authentication device, so that the authentication device obtains the attribute setting information by decrypting, and according to the attribute Setting information to set an operator attribute of the authentication device, wherein the attribute setting information has at least an International Mobile Subscriber Identification Number (IMSI) and an authentication key (Key identifier, Ki).

According to another aspect of the embodiments of the present application, the communication control device is provided to the mobile terminal.

According to another aspect of the embodiments of the present application, the communication control device further has a switching control unit,

a handover control unit, configured to receive a notification that the authentication device successfully sets the operator attribute, and, if the carrier attribute is two or more, perform carrier attribute according to the received handover instruction Selecting to cause the mobile terminal to switch to communicate with a network corresponding to the selected carrier attribute.

According to another aspect of the embodiments of the present application, the communication control device further has:

And a deletion control unit, configured to control the authentication device to delete the operator attribute according to the received deletion instruction.

According to still another aspect of the embodiments of the present application, an authentication apparatus is provided, configured to be used by a mobile terminal to perform mobile user identity authentication, so that the mobile terminal communicates in a network, the authentication apparatus having:

a third obtaining unit, configured to acquire, by the communication control device of the mobile terminal, a session key delivered by the server, and attribute setting information encrypted by the session key;

a decryption unit, configured to decrypt the attribute setting information encrypted by the session key according to the decryption algorithm and the session key, to obtain the attribute setting information;

And a setting unit configured to set an operator attribute of the authentication device according to the attribute setting information.

According to another aspect of the embodiments of the present application, the authentication apparatus further includes a storage unit that stores the attribute setting information, an encryption algorithm, and the decryption algorithm.

According to another aspect of the embodiments of the present application, the authentication device further includes a notification unit that transmits the notification information after the setting unit successfully sets the operator attribute.

According to another aspect of the embodiments of the present application, the authentication device is a Subscriber Identity Module (SIM) card, a chip that is attached to the customer identification module card, or the customer identification module card. A device built into the mobile terminal having an equivalent function.

According to still another aspect of the embodiments of the present application, a central control device is provided, which is disposed at a server, and the central control device has:

a first receiving unit, which receives identification information of an authentication device for performing mobile user identity authentication provided on the mobile terminal;

a second authentication unit, configured to perform identity authentication on the authentication device according to the identification information and the encryption information, and establish a session key if the authentication is successful;

a second sending unit, configured to send the session key and the attribute setting information encrypted by the session key to the mobile terminal, so that the authentication device obtains the attribute setting information by decrypting, and according to the Genus The attribute setting information is used to set an operator attribute of the authentication device, wherein the attribute setting information is stored in the server.

According to another aspect of the embodiments of the present application, the central control device further has a management unit for managing the attribute setting information. .

The utility model has the beneficial effects that the communication control device can send the encrypted attribute setting information and the session key obtained from the server to the authentication device, and the authentication device can set according to the attribute setting information delivered by the server. Or updating the operator attribute of the authentication device, so that the user can conveniently write the card to the authentication device through the communication control device, thereby improving the flexibility of the user to write the card, and the authentication device has multiple The number resource of the operator enables the user to independently select and use the network service of multiple operators at any time and place.

Specific embodiments of the present application are disclosed in detail with reference to the following description and accompanying drawings, in which <RTIgt; It should be understood that the embodiments of the present application are not limited in scope. The embodiments of the present application include many variations, modifications, and equivalents within the scope of the appended claims.

Features described and/or illustrated with respect to one embodiment may be used in one or more other embodiments in the same or similar manner, in combination with, or in place of, features in other embodiments. .

It should be emphasized that the term "comprising" or "comprises" or "comprising" or "comprising" or "comprising" or "comprising" or "comprises"

DRAWINGS

The drawings are included to provide a further understanding of the embodiments of the present application, and are intended to illustrate the embodiments of the present application Obviously, the drawings in the following description are only some of the embodiments of the present application, and those skilled in the art can obtain other drawings according to the drawings without any inventive labor. In the drawing:

1 is a schematic diagram of a composition of a communication control apparatus according to an embodiment of the present application;

2 is a schematic diagram of a composition of an authentication apparatus according to an embodiment of the present application;

3 is a schematic diagram of a composition of a central control device according to an embodiment of the present application;

4 is a flow chart of setting a carrier attribute for an authentication device according to the present embodiment.

detailed description

The foregoing and other features of the present application will be apparent from the description, The specific embodiments of the present application are specifically disclosed in the specification and the drawings, which illustrate a part of the embodiments in which the principles of the present application may be employed, it being understood that the present application is not limited to the described embodiments, but instead The application includes all modifications, variations and equivalents falling within the scope of the appended claims. Various embodiments of the present application will be described below with reference to the accompanying drawings. These embodiments are merely exemplary and are not limiting of the application.

In the present application, the communication control device and the central control device may be implemented by software. For example, the communication control device may be an application (Application, APP) used by the mobile terminal, and the central control device may be a program used by the server; The present embodiment is not limited thereto, and the communication control device and the central control device may be implemented by hardware or may be implemented by hardware and software. For specific implementation, reference may be made to the prior art.

In the present application, the authentication device may be a Subscriber Identity Module (SIM) card, a chip attached to the customer identification module card, such as a SIM film card, or an equivalent function integration with the customer identification module card. The device to the mobile terminal, such as an eSIM card or the like; the functions of the components of the authentication device can be implemented by software running on the authentication device. For example, the software can be an on-chip operating system (Chip Operation System, COS). ). However, the present embodiment is not limited thereto, and the functions of the components of the authentication device may also be implemented by hardware, or may be implemented by hardware and software. The specific implementation manner may refer to the prior art.

In the present application, the mobile terminal may be a portable electronic device such as a feature phone, a smartphone or a tablet.

Example 1

The embodiment of the present application provides a communication control apparatus, which controls an authentication apparatus for performing mobile user identity authentication on a mobile terminal, so that the mobile terminal can select different carrier networks for communication.

1 is a schematic diagram of a configuration of a communication control apparatus according to the present embodiment. As shown in FIG. 1, the communication control apparatus 100 may be provided with a first acquisition unit 101, a first authentication unit 102, a second acquisition unit 103, and a first transmission unit. 104.

The first obtaining unit 101 is configured to obtain the identification information of the authentication device. For example, the identification information may be an Integrated Circuit Card Identity (ICCID). Of course, the identification information may also be other information. The first authentication unit 102 is configured to send the identification information to the server, so that the server performs identity authentication on the authentication device; the second obtaining unit 103 is configured to acquire a session key from the server, and is encrypted by the session key. Attribute setting information; the first sending unit 104 is configured to use the session key and the adding The secret attribute setting information is sent to the authentication device, so that the authentication device obtains the attribute setting information by decrypting, and sets the operator attribute of the authentication device according to the attribute setting information.

In this embodiment, the attribute setting information may be, for example, an International Mobile Subscriber Identification Number (IMSI) and an authentication key (Key identifier, Ki), etc.; however, the implementation is not limited thereto, and the attribute is not limited thereto. The setting information may also be other information as long as the authentication device can be controlled to set its carrier attribute to enable the mobile terminal to communicate with the network corresponding to the carrier attribute.

With the present embodiment, the communication control apparatus can transmit the encrypted attribute setting information and the session key obtained from the server to the authentication apparatus, whereby the authentication apparatus can be under the control of the communication control apparatus The attribute setting information, such as IMSI and Ki, is set to set or update the operator attribute of the authentication device itself, and the carrier attribute may be, for example, IMSI and Ki, etc., thereby enabling the user to authenticate in a convenient manner. The rights device writes the card, so that if the carrier attribute is selected, the corresponding phone number is used to communicate in the network corresponding to the carrier attribute.

In this embodiment, the first obtaining unit 101 can obtain the ICCID of the authentication device by using the ICCID query interface of the authentication device. In addition, the first obtaining unit 101 can also obtain the operator of the authentication device. If the attribute is set, for example, the first obtaining unit 101 can obtain information about whether the IMSI of the authentication device is configured through the IMSI configuration information query interface of the authentication device.

In this embodiment, if the communication control device acquires that the operator attribute of the authentication device has not been set, the server may be requested to send the attribute setting information, if the communication control device acquires the carrier attribute of the authentication device. It has been set up to enable the mobile terminal to communicate using a network corresponding to the carrier attribute.

In this embodiment, the first authentication unit 102 may, for example, invoke the server interaction interface of the communication control device to send the ICCID of the authentication device to the server, so that the server performs identity authentication on the authentication device according to the ICCID. If the identity authentication succeeds, the server can provide the service to the authentication device. If the identity authentication is unsuccessful, the authentication device is not registered in the server in advance and does not belong to the server. In addition, the first authentication unit 102 can also perform identity authentication on the server to confirm whether the server is a legitimate server, and prevent the mobile terminal from connecting to the pseudo server. In this embodiment, the specific manner in which the server authenticates the authentication device and the communication control device performs identity authentication on the server may be in the prior art, and is not particularly limited in this embodiment.

In this embodiment, the second obtaining unit 103 may, for example, invoke a server interaction interface of the communication control device to receive a session key from the server and encrypted attribute setting information. And, in this embodiment, The encrypted attribute setting information from the server may be two or more, whereby two or more operator attributes may be set in the authentication device, and the two or more attributes may respectively correspond to different network operators, thereby The mobile terminal can switch between networks provided by a plurality of different network operators.

In this embodiment, the first sending unit 104 can send a session key and encrypted attribute setting information to the authentication device, for example, through an interface for data interaction with the authentication device, so that the authentication device obtains the decryption by decryption. The attribute setting information, and setting an operator attribute of the authentication device according to the attribute setting information.

In this embodiment, as shown in FIG. 1, the communication control apparatus 100 may further have a handover control unit 105 for receiving a notification that the authentication apparatus successfully sets the operator attribute, and in the operation In the case where the quotient attribute is two or more, the operator attribute is selected according to the received switching instruction, so that the mobile terminal switches to communicate with the network corresponding to the selected carrier attribute. For example, the authentication device of the mobile terminal is provided with more than two carrier attributes, or the mobile terminal is provided with more than two authentication devices, and each authentication device is provided with at least one operator attribute In this case, the operator corresponding to the two or more operator attributes may be displayed on the user interface (UI) of the mobile terminal, and the user's selection operation on an interface on the interface may be converted into The switching instruction is sent to the switching control unit, and further, the switching control unit sends a control signal to the authentication device, so that the authentication device selects the IMSI and Ki corresponding to the operator selected by the user, so that the mobile terminal Switching to communication in the network corresponding to the selected IMSI and Ki. In this embodiment, the specific method for the authentication device to select the corresponding IMSI and Ki to enable the mobile terminal to communicate in the corresponding network may refer to the prior art, and details are not described herein again.

The handover control unit 105 can select one of the operator attributes to cause the mobile to switch to communicate with the network corresponding to the selected carrier attribute.

In this embodiment, as shown in FIG. 1, the communication control apparatus 100 may further have a deletion control unit 106 for controlling the authentication apparatus to delete the operator attribute. For example, the deletion control unit 106 may pass The interface for performing data interaction with the authentication device sends a control command for deleting the operator attribute to the authentication device, so that the authentication device deletes the corresponding operator attribute according to the control instruction.

In the present application, the communication control device can connect to the Internet via a wireless local area network or the like via a network connection module of the mobile terminal, thereby performing data interaction with the server, thereby being able to learn from the case where the operator's mobile network cannot be covered. The device sets the carrier attribute.

In addition, in this embodiment, the communication control apparatus 100 may further have an online banking payment unit (not shown). The online banking payment unit is used to provide the online banking payment function. For the implementation manner of the online banking payment unit, reference may be made to the prior art, which is not described in this embodiment.

In this embodiment, the communication control device 100 can be disposed on the mobile terminal to control the authentication device of the mobile terminal. However, the embodiment is not limited thereto, and the communication device 100 can also be disposed on other mobile terminals or electronic devices to control the authentication device on the mobile terminal by remote control.

With the embodiment of the present application, the communication control apparatus can transmit the encrypted attribute setting information and the session key obtained from the server to the authentication apparatus, whereby the authentication apparatus can be based on the control apparatus under the control of the communication control apparatus Attribute setting information delivered by the server, such as information such as IMSI and Ki, to set or update the operator attributes of the authentication device itself, such as IMSI and Ki, etc.; and, by setting the switching control unit, the mobile terminal can be made different Switching between networks without replacing the authentication device, whereby the user can conveniently switch the carrier network used by the mobile terminal; and the communication control device can connect to the Internet through a wireless local area network or the like, and perform data with the server. The interaction is to set the operator attribute for the authentication device, whereby the card can be written without relying on the coverage of the mobile network.

Example 2

The embodiment of the present application provides an authentication device, which is disposed in a mobile terminal, is configured to perform mobile user identity authentication, so that the mobile terminal communicates in a network, and the authentication device is described in Embodiment 1. Controlled by the communication control device.

FIG. 2 is a schematic diagram of a composition of the authentication apparatus of the embodiment. As shown in FIG. 2, the authentication apparatus may have a third obtaining unit 201, a decrypting unit 202, and a setting unit 203.

The third obtaining unit 201 is configured to acquire, by the communication control device of the mobile terminal, a session key sent by the server, and attribute setting information encrypted by the session key; and the decrypting unit 202 is configured to use the decryption algorithm. And decrypting the session key to obtain the attribute setting information; the setting unit 203 is configured to set an operator attribute of the authentication device according to the attribute setting information.

In this embodiment, the third obtaining unit 201 can obtain the session key sent by the server from the communication control device 100 and encrypt the session key through the interface of the data communication with the communication control device 100 of the embodiment 1. Property setting information.

In this embodiment, the decryption unit 202 may decrypt the attribute setting information encrypted by the session key according to the decryption algorithm and the session key to obtain the attribute setting information. In this embodiment, the decryption The algorithm may be, for example, an SM4 data decryption algorithm and/or a SM3-HMAC (Hash-based Message Authentication Code) algorithm, and the decryption unit 202 may be, for example, by calling an SM4 data encryption/decryption interface and/or an SM3-HMAC algorithm interface. The decryption operation is performed to obtain the attribute setting information, such as IMSI and KI. Of course, the embodiment is not limited thereto, and other decryption algorithms may be used for decryption.

In this embodiment, the setting unit 203 may set the operator attribute of the authentication device according to the attribute setting information. For example, the setting unit 203 may invoke the IMSI configuration interface and the Ki configuration interface, and obtain the server according to the decryption. The IMSI and Ki are sent to set the IMSI and Ki of the authentication device itself, wherein the IMSI can distinguish and identify the user of the mobile network, and Ki is the key for encrypting data transmission between the authentication device and the operator, and According to IMSI and Ki, the mobile terminal can communicate in a network provided by a network operator corresponding to the ISMI and Ki.

In this embodiment, as shown in FIG. 1, the authentication apparatus may further have a notification unit 204, after the setting unit 203 successfully sets the operator attribute, send notification information to the communication control apparatus of Embodiment 1. Thereby, the communication control device can confirm that the operator attribute is successfully configured based on the notification information.

In this embodiment, as shown in FIG. 1, the authentication apparatus may further include a storage unit 205 for storing the attribute setting information, an encryption algorithm, and a decryption algorithm, for example, an SM4 data encryption and decryption algorithm and an SM3-HMAC. Algorithms, etc.

In addition, in this embodiment, the authentication apparatus may further provide a data path conforming to a Transport Protocol Data Unit (TPDU) protocol, so that the authentication apparatus performs data transmission with the outside; and further, the authentication The device may also have a noise source read interface, and the description of the noise source read interface may also refer to the prior art.

In addition, in this embodiment, the authentication device may further include an ICCID query interface and an IMSI configuration information query interface, etc., for providing the communication control device of Embodiment 1 with the query result of the ICCID and the IMSI configuration information of the authentication device. .

According to the embodiment, the authentication device is capable of decrypting the encrypted attribute setting information sent by the server received by the communication control device of the mobile terminal, and then setting the operator attribute of the authentication device according to the attribute setting information. Thus, the mobile terminal can communicate in a network provided by a network operator corresponding to the carrier attribute.

Example 3

The embodiment of the present application provides a central control device, which is disposed at a server.

FIG. 3 is a schematic diagram of a composition of a central control device according to an embodiment of the present application. As shown in FIG. 3, the central control device 300 has a first receiving unit 301, a second authentication unit 302, and a second transmitting unit 303.

The first receiving unit 301 receives the identification information of the authentication device for performing mobile user identity authentication on the mobile terminal. For example, the identification information may be an integrated circuit card identifier, and the identification information may also be other. The second authentication unit 302 performs identity authentication on the authentication device according to the identification information and the encryption information, and establishes a session key if the authentication is successful; the second sending unit 303 sends the session to the mobile terminal. a key and attribute setting information encrypted by the session key, so that the authentication device obtains the attribute setting information by decrypting, and setting an operator attribute of the authentication device according to the attribute setting information, wherein the attribute setting information Stored on this server.

In this embodiment, the first receiving unit 301 can receive the ICCID of the authentication device from the communication control device 100 of Embodiment 1, for example, the first receiving unit 301 can invoke an interface in the server for communicating with the mobile terminal. To receive the ICCID.

In this embodiment, the second authentication unit 302 can perform identity authentication on the authentication device according to the received ICCID and the encrypted information to determine whether to provide services for the authentication device. If the authentication fails, the central control device refuses to provide service for the authentication device; if the authentication is successful, the central control device provides service for the authentication device and establishes a session key.

In this embodiment, the second sending unit 303 may invoke an interface in the server for communicating with the mobile terminal, and send the session key and the attribute setting information encrypted by the session key to the mobile terminal, so that the The authentication device obtains the attribute setting information by decrypting, and sets an operator attribute of the authentication device according to the attribute setting information.

In this embodiment, the attribute setting information may be pre-stored in a database of the server, for example, and the central control device may obtain the attribute setting information by calling an interface that accesses the database, and use the session. The key encrypts the attribute setting information.

In this embodiment, the central control device 300 may further include a management unit 304 for managing the attribute setting information. In a specific implementation, the management unit 304 may be configured to update the attribute setting information stored in the server according to the data of the network operator, for example, when the user reports the mobile phone number, the network operator may The information related to the mobile phone number in the database is cleared or changed. At this time, the central control device obtains the number of network operators through the interface provided for the network operator. According to the update information, the management unit 304 further performs update processing such as clearing or changing the attribute setting information stored in the server based on the data update information of the network operator.

Further, in the present embodiment, the center control device 300 may further have an internet banking payment interface (not shown). When the mobile terminal performs online banking payment, the network banking payment interface can be used for an authentication interface between the server and the network bank.

According to the embodiment, the central server can issue the attribute setting information to the authentication device in an encrypted manner, whereby the authentication device can obtain the attribute setting information in a secure manner and set its own carrier attribute to make the mobile The terminal communicates in a network provided by a network operator corresponding to the carrier attribute.

Example 4

Embodiment 4 of the present application provides a communication system, which is composed of the communication control device 100 of Embodiment 1, the authentication device 200 of Embodiment 2, and the central control device of Embodiment 3, and a detailed description of each component device of the system, Reference may be made to Embodiment 1 to Embodiment 3, and the description is not repeated in this embodiment.

4 is a flow chart of setting a carrier attribute for an authentication device according to the present embodiment. As shown in Figure 4, the process includes:

S1, starting the communication control device 100, and acquiring identification information (for example, ICCID, etc.) of the authentication device and information on whether the IMSI is set;

S2, if it is determined that the IMSI is not set, the authentication device is not turned on, and further, after receiving the instruction sent by the user to activate the authentication device, the communication control device 100 transmits the identification information to the central control device 300 ( Such as ICCID, etc.);

S3. The central control device performs identity authentication according to the identification information (for example, ICCID, etc.) and the encrypted information. When the authentication is successful, the session key is established, and the IMSI and the Ki are encrypted by using the session key.

S4, the session key and the encrypted IMSI and Ki are sent to the communication control device 100;

S5, the communication control device 100 sends the session key and the encrypted IMSI and Ki to the authentication device 200;

S6, the authentication device 200 decrypts according to the session key and the decryption algorithm to obtain the IMSI and Ki delivered by the server;

S7, the authentication device 200 sets the IMSI and Ki in the authentication device 200 according to the IMSI and Ki delivered by the server;

S8, the authentication device 200 transmits the notification information for successfully setting the IMSI and Ki to the communication control device 100.

According to S1-S8 of FIG. 4, an operator attribute can be set for the authentication device 200, that is, a card writing operation is performed on the authentication device.

In addition, in this embodiment, the authentication device may also be controlled by the communication control device to delete the operator attribute, that is, perform a card clearing operation on the authentication device.

Further, in the present embodiment, when it is determined in the above step S2 that the IMSI of the authentication apparatus 200 has been set, the communication control apparatus 100 can control the authentication apparatus to select the IMSI and Ki to make the mobile apparatus Switching to and communicating with the network provided by the operator corresponding to the selected IMSI and Ki.

In addition, in this embodiment, the management unit 304 of the central control device 300 can update the attribute setting information stored in the server according to the data of the network operator, thereby stopping the providing of the service to the lost authentication device. That is, the authentication device is lost.

In addition, in the embodiment, the network bank payment unit and the central control device 300 of the communication control device 100 can also have a network bank payment interface to implement the function of the network bank payment.

According to the embodiment, the intermediate links and restrictions of the conventional write card and the network access can be effectively reduced, and functions such as writing a card, clearing the card, and switching the network can be conveniently performed, thereby improving the user's autonomy.

The above device of the present application may be implemented by hardware or by hardware combined with software. The present application relates to a computer readable program that, when executed by a logic component, enables the logic component to implement the apparatus or components described above, or to implement the various methods described above Or steps. The application also relates to a storage medium for storing the above program, such as a hard disk, a magnetic disk, an optical disk, a DVD, a flash memory, or the like.

The present invention has been described in connection with the specific embodiments thereof, but it is to be understood that the description is intended to be illustrative and not restrictive. Various modifications and alterations of the present application are possible in light of the spirit and scope of the invention, which are also within the scope of the present application.

Claims

A communication control device controls an authentication device for performing mobile user identity authentication on a mobile terminal, so that the mobile terminal selects a different carrier network for communication, and the communication control device is configured to be a mobile terminal, and the communication control device has:

a first obtaining unit, configured to acquire identification information of the authentication device;

a first authentication unit, configured to send the identification information to a server, so that the server performs identity authentication on the authentication device;

a second obtaining unit, configured to acquire a session key from the server and attribute setting information encrypted by the session key, if the server performs identity authentication successfully;

a first sending unit, configured to send the session key and the encrypted attribute setting information to the authentication device, so that the authentication device obtains the attribute setting information by decrypting, and according to the attribute Setting information to set an operator attribute of the authentication device,

The attribute setting information has at least an International Mobile Subscriber Identification Number (IMSI) and an authentication key (Key identifier, Ki).

The communication control device performs data exchange with the server by connecting to the Internet.
The communication control device according to claim 1, wherein

The communication control device is disposed at the mobile terminal.
The communication control device according to claim 1, wherein said communication control device further has:

a handover control unit, configured to receive a notification that the authentication device successfully sets the operator attribute, and, if the carrier attribute is two or more, perform carrier attribute according to the received handover instruction Selecting to cause the mobile terminal to switch to communicate with a network corresponding to the selected carrier attribute.
The communication control device according to claim 1, wherein said communication control device further has:

And a deletion control unit, configured to control the authentication device to delete the operator attribute according to the received deletion instruction.
An authentication device is disposed on the mobile terminal, configured to perform mobile user identity authentication, so that the mobile terminal communicates in a network, the authentication device has:

a third acquiring unit, configured to communicate with a communication control device provided in the mobile terminal, to receive a session key sent by the server acquired by the communication control device, and an attribute setting letter encrypted by the session key interest;

a decryption unit, configured to decrypt the attribute setting information encrypted by the session key according to the decryption algorithm and the session key, to obtain the attribute setting information;

a setting unit configured to set an operator attribute of the authentication device according to the attribute setting information,

The attribute setting information has at least an International Mobile Subscriber Identification Number (IMSI) and an authentication key (Key identifier, Ki).

The communication control device performs data exchange with the server by connecting to the Internet.
The authentication device of claim 5, wherein the authentication device further has:

a storage unit that stores the attribute setting information, an encryption algorithm, and the decryption algorithm.
The authentication device of claim 5, wherein the authentication device further has:

a notification unit that transmits notification information after the setting unit successfully sets the operator attribute.
The authentication device according to claim 5, wherein

The authentication device is a Subscriber Identity Module (SIM) card, a chip attached to the customer identification module card, or a device built in the mobile terminal having the same function as the customer identification module card. .
A central control device is disposed at a server, and the central control device has:

a first receiving unit that communicates with a communication control device provided in the mobile terminal, thereby receiving identification information of the authentication device for performing mobile user identity authentication provided on the mobile terminal;

a second authentication unit, configured to perform identity authentication on the authentication device according to the identification information and the encryption information, and establish a session key if the authentication is successful;

a second transmitting unit, configured to send the session key and attribute setting information encrypted by the session key to the communication control apparatus provided to the mobile terminal, so that the communication control apparatus sets the session The key and the encrypted attribute setting information are sent to the authentication device, and the attribute setting information is obtained by the authentication device by decryption, and the operation of the authentication device is set according to the attribute setting information. Business attribute,

The attribute setting information has at least an International Mobile Subscriber Identification Number (IMSI) and an authentication key (Key identifier, Ki).

The communication control device performs data exchange with the server by connecting to the Internet.
The center control device according to claim 9, wherein the center control device further has:

A management unit for managing the attribute setting information.